The DMZ

6:52 AM

@BenoitEsnard I also lost 10 rep due to account deletion. It's just part of the game I guess

7:04 AM

Please give me some feedback on my 5 security guidelines:
1.) "Secure" is a verb, not an adjective.
2.) To secure your assets from a threat, you need to know the threat.
3.) Well-Tested beats new and shiny.
4.) The illusion of security is worse than the knowledge of insecurity.
5.) Proactive security is cheaper than reactive security.

MechMK1

8:22 AM

Finally fixed VirtualBox not showing my second monitor

Turns out that I used the wrong adapter.

Instead of VMSVGA, you need VBoxSVGA

MechMK1

9:21 AM

Why on earth does filteries think that this is "slightly-leftleaning"?

tungsten

10:37 AM

looks like my toolbox when i was three

lol

MechMK1

@tungsten My screenshot? :D

tungsten

yes

MechMK1

What's wrong with it?

Conor Mancone

12:15 PM

@MechMK1 Sounds pretty good. I'm trying to remember if I have other general principles I would add/modify, but none come immediately to mind

MechMK1

@ConorMancone Thanks. I would just like to write down some guidelines I can refer to while talking to some (not necessarily security-versed) folks

Here are some lines that inspired me:
1.) "We made this huge product in the past few years, now we want to make it secure."
2.) "I don't know against what. I just want security"
3.) "Why don't we use this new technology instead? It came out a month ago, so it's already well-established"
4.) "We don't care about what you call 'real security', we just want our customers to 'feel secure'."
5.) "This would be much too expensive. We'll just fix it when it becomes a problem."

Conor Mancone

i.e. basically every question here...

MechMK1

Nr. 2 is a very Sec.SE thing to say :D

0

Q: Hydra - command problem

Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing one of the usernames. Below is the command I am using: hydra -L femalenames-usa-top1000.txt -p pword 34.94.3.143 -u http-post-form "/c1b6...

I am so tempted to vote this off topic, but I want to be nice and help a newcomer

Conor Mancone

12:36 PM

@MechMK1 For questions that are skirting the line comments are usually a good start. Then I just come back the next day. If the OP hasn't responded or made any additional effort, then it's time to bring the close-hammer down.

MechMK1

@ConorMancone I'll see if he can formulate a concise, answerable question

If not, unclear what you're asking it is

Also:

-454

Q: Official FAQ on gender pronouns and Code of Conduct changes

We expect today’s changes to the Code of Conduct to generate a lot of questions. We’ve tried to anticipate some of the most common questions people may have here, and we’ll be adding to this list as more questions come up. Q1: What are personal pronouns, and why are they relevant to the Code of ...

discussion faq featured code-of-conduct announcements

-454 votes. Such a popular new change

**Q11: If I’m uncomfortable with a particular pronoun, can I just avoid using it?**

We are asking everyone to use all stated pronouns as you would naturally write. Explicitly avoiding using someone’s pronouns because you are uncomfortable is a way of refusing to recognize their identity and is a violation of the Code of Conduct.

Oh boy, there is no way that this is going well

Conor Mancone

wow

I hadn't seen that yet

MechMK1

Oh there's a thing you don't like and you'd rather not engage with it?
Fuck you, that's a violation!

Angry Video Game Nerd: "What were they thinking!?" Reel

►

Conor Mancone

I think it might legitimately be easier to just always use peoples names...

MechMK1

@ConorMancone What if someone insisted on using their pronouns?

What if someone said "Thank you for your comment, but I feel as if you explicitly omitted my pronouns as a political statement."

Remember when everybody said "Just chill, wait for the new CoC update to actually come out"? I remember

the new CoC is literally just as bad as everybody predicted it

And I'm not the vocal minority here, not the hateful extreme-right troll that just tries to make everybody feel unwelcome. -454 votes show that more than a "tiny vocal minority" disagree with this change

Benoit Esnard

12:47 PM

@MechMK1 Those are great advices, in my opinion.

Conor Mancone

Honestly, I don't even know what to think about this. If someone wanted me to call them "Xe Clucky Mc Crazies" then hey, whatever works for you, no skin off my back. ctrl+c and ctrl+v are my friends.
It's not going to stop me from having a conversation with some random stranger on the internet.

but... well... yeah... I think this is getting borderline crazy...

MechMK1

@BenoitEsnard Thank you

@ConorMancone Not on the internet, but on SE

I just find the idea that someone can dictate their world-view on me on a supposedly neutral site and I am forced to pretend like I agree with it.

I swear to God, I know one day I will get banned from SE for wrongthink and incitement of hate speech.

People criticized the usage of the word "orwellian". If dictation of language to be used to limit critical thinking isn't orwellian by definition, I don't know what is.

Conor Mancone

1:07 PM

Relevant XKCD

Constantly stopping these briefings halfway through is becoming a pain.

Except less funny in real life

MechMK1

@ConorMancone Except that I don't get it in this context :D

Conor Mancone

Godwin's law is the whole "any argument will ultimately devolve into accusing someone of being Hitler".

In this case the comic takes place during WWII, where comparing to Hitler is actually perfectly reasonable, but the general in command is being told he can't make Hitler comparisons because doing so is just a sign that he's committing logical fallacies

MechMK1

I understand. I didn't know we already reached the "Everyone who disagrees with the new Code-of-Conduct is a nazi", although the views of SE employees are dangerously close already

Conor Mancone

You're 100% right - this is pretty much the definition of Orwellian. But that doesn't mean you won't get yelled at for calling it Orwellian

MechMK1

@ConorMancone I don't care about people disagreeing with me. As someone who has my political worldviews, public disagreement is the norm.

I love how Stack Exchange, Inc. aimed to make the Stack Exchange Network more inclusive, yet every criticism of the policy is met with "If you don't like it, then you should leave". It seems like "Exclusion means Inclusion" could be SE, Inc.'s new slogan.

Conor Mancone

1:16 PM

The irony is not lost on me

But then again I've been having this same argument in religious circles for decades

MechMK1

"Freedom is Slavery", "War is Peace", "Exclusion is Inclusion"

@ConorMancone Which argument?

Conor Mancone

I remember a long time ago having dinner with some friends talking about religion and what's true and what isn't. Someone made the inevitable: "You can't tell me what's true for me" only to be met with: "But then why do you get to tell me what I can or cannot say?"

(badly paraphrased, but that's what this reminds me of)

MechMK1

Quite a philosophical question

Is truth objective? Or is truth constructed by each individual?

Conor Mancone

"We want to be more inclusive, so I need all of you to leave"

MechMK1

Worked so well in Star Wars

Conor Mancone

1:20 PM

@MechMK1 I'm pretty sure Captain Metaphysics answered that one conclusively

MechMK1

My favourite argument was as follows:

Conor Mancone

existentialcomics.com/comic/143

MechMK1

"A rock only exists if I acknowledge it!"
"I would wager if I throw a rock at the back of your head, the rock can make you acknowledge it"

Conor Mancone

lol, yup.

MechMK1

But as I wanted to say, truth these days is formed by social media censorship

"True is what you read on Facebook, as long as you read it often enough"

A. Hersean

1:26 PM

Truth is fake news.

Indiana Pi Bill

The Indiana Pi Bill is the popular name for bill #246 of the 1897 sitting of the Indiana General Assembly, one of the most notorious attempts to establish mathematical truth by legislative fiat. Despite its name, the main result claimed by the bill is a method to square the circle, rather than to establish a certain value for the mathematical constant π, the ratio of the circumference of a circle to its diameter. The bill, written by the crank Edward J. Goodwin, does imply various incorrect values of π, such as 3.2. The bill never became law, due to the intervention of Professor C. A. Waldo of...

MechMK1

@A.Hersean I read that!

Oh my god, they removed "Assume good faith" from the CoC because "it would just help the trolls"

HOLY FUCKING SHIT

152

Q: We need "assume good intent" back in the Code of Conduct

AT some point - "assume good intent" was removed from the COC It's a key pillar of the social contract and how we choose to deal with each other. It belongs in the Code of Conduct. PLEASE add this back. Its been brought up that I asked for this in the feedback for previous revision of the COC...

feature-request code-of-conduct

So now we have the construct that you're dictated what language to use, and if you fail to do so, moderators can just ban you. Afterall, we don't have to assume that you meant well.

Conor Mancone

1:40 PM

Now that it's been rolling around for a while, I think one of my questions is, "Why is this the hill you chose to die on?" I'd approach this from a threat modelling perspective. "We want to make sure our users are feeling welcome". How do we protect them from unwelcome? What are the sources of unwelcome?

MechMK1

Do you want my unfiltered opinion?

Conor Mancone

Option #1: having questions downvoted/closed makes people feel unwelcome
Option #2: snarky responses, "did you google it?", etc, makes people feel unwelcome
Option #3: using the wrong pronouns makes people unwelcome

MechMK1

I think that SE, Inc. is trying to show a particular political stance.

Conor Mancone

Seems like SE decided to go all in on option #3, but I really doubt that's the biggest (or even a tiny) source of "unwelcome" for users. (insert relevant security analogy here)

Granted, these things aren't mutually exclusive, but this still seems like a terrible choice of places to make a last stand

@MechMK1 Oh, I 100% agree with you

Is that your unfiltered opinion, because I expected less filtering :)

MechMK1

@ConorMancone They did it with the rainbow flag, and now they did it here

If you wanted me to turn all filters off, I would be purged

SE is trying to politicize the site, and that with a healthy dose of "Everyone who does no agree is a bigot"

Conor Mancone

1:44 PM

Oh yeah, rainbow flags. Bitbucket did something like that on their anniversary.

132

Q: Atlassian "logo" after pushing to bitbucket

Having pushed to bitbucket I got this "image". What is this?

git bitbucket

When I saw that I nearly had a heart-attack. I thought something had gone very, very badly wrong

After a while I realized it was a "harmless" political response from my git server while going about doing my daily thing. Still didn't get my hour of panic back

MechMK1

That's the problem: People expect technology to be neutral.

git is neither left-wing nor right-wing.

Conor Mancone

I really hate it when tech companies get all political

MechMK1

Neither is ls, echo, or vim

Imagine, every time you booted your OS, you would have to answer a set of questions to ensure you have the right political opinions.

Conor Mancone

Give it a few more years...

it won't be hypothetical

MechMK1

"Here at PurityOS we want to ensure that only the most aryan übermenschen among us are able to use our operating system" - as a rather extreme example.

What a fucking joke

I'm sure Facebook is already doing this

Twitter certainly is. They "shadowban" users they deem too right-wing

If you are shadowbanned, mentioning somebody will not generate a notification. Your tweets will not show up in people's feeds (even if they follow you) or in searches. The only way to see your tweets is by explicitly visiting your profile.

In an environment where personal identity more and more shifts to social networks, shadowbanning is the equivalent of erasing you and your voice.

And I personally don't believe in the "It's not a free speech violation. People just hate you and show you the door", because it's the exact opposite. It's preventing me from speaking to people who want to hear what I say.

This world is getting more fucked up by the minute and nobody seems to care. Instead, we get spoonfed bullshit news about which celebrities marries whom, etc.

I feel like I am living in a twisted dystopia and nobody else gives a fuck.

Conor Mancone

1:56 PM

I stopped using social media a few years ago. It's a choice that I don't regret in the slightest

MechMK1

Me too. I never had a Facebook account, and I deleted my Twitter account several years ago.

The problem is that cyberpunk is already here, but it's way less cool than I had imagined it.

Conor Mancone

wow. this never happens (read comment from OP)

security.stackexchange.com/questions/219445/…

MechMK1

What the actual fuck? Really?
That's awfully nice of Luke

Can't say "him" though :D

Conor Mancone

:) He did end up posting on softwarerecommendations

I'd upvote him just for closing his question here, except I don't actually want to join another community...

MechMK1

That's really nice. I hope he finds a solution for his problem

Anyways, I'll be off to fetch my new minis

Did I already show you the latest thing I finished painting?

I have to shill wherever I can, since I don't have any social media :D

Conor Mancone

2:12 PM

Warhammer 40K? No, I think I missed it

MechMK1

One sec

imgur.com/a/CW2jjRQ

Any feedback is welcome, I'll read it when I can

Conor Mancone

Oh yeah, definitely no feedback. I'm genuinely bad at stuff like this. I find it very entertaining though. It's like watching birds fly: "I wish I could do that, but at least I can pretend from here!" lol

@MechMK1 Looks sweet though! Not that I'm a great judge. It's definitely much better than anything I ever did

NH.

6:57 PM

does anyone know if there is a secure alternative to keybase.io?

Rory Alsop

@NH. What do you find insecure about it?

NH.

hosting private keys

they don't seem to want you to send messages back and forth unless you host your private keys (or maybe I'm missing something).

Rory Alsop

@NH. Hang on - that doesn't sound right

just checking how mine works for different use cases

Looks okay

keybase.io/docs/crypto/local-key-security

NH.

7:24 PM

that still doesn't meantion hosted keys

in fact, I'm not seeing any documentation on their site on how they keep hosted keys secure (by default, that makes me suspect that they aren't really kept that secure).

the only documentation I see about it is keybase.io/decrypt, and it simply says "you must host your private key in Keybase's encrypted key store."

Is this worth a question on the site, or should we keep it here in Chat?

Rory Alsop

@NH. I think it would be a good question on the site

NH.

8:00 PM

@RoryAlsop K thx. I posted: security.stackexchange.com/q/219471/149193 Let me know if there is any way I can improve my question. I tend to be bad at this.

Transcript for